MISSING_SUBJECT + HEADER REWRITE bug?

[Vaccus Spurcamen]

Apologies if this has been covered before. I'm invoking the milter via
Postfix like this;

(main.cf)
smtpd_milters = unix:/var/spool/mail/private/samilter

And for the last 12 months it's worked with no real issues. Recently I
increased the score in spamassassin for 'missing subject' to 8 and then
started to see issues with mail being rejected. When I looked at what
the milter was doing, I noticed it always hits the missing subject rule,
despite the subject being clearly in the message headers.

I also noted that the increase in score rewrote the subject as I
expected, but did not prepend [spam score] [original subject] - it
replaced it with just the score - which had me spending a couple of
hours thinking that the subject was really missing. I also noted that
there was no subject anywhere in the headers other than at the bottom,
as shown here:

X-Spam-Flag: YES
X-Spam-Status: Yes, score=6.6 required=5.0
 tests=ALL_TRUSTED,MISSING_SUBJECT autolearn=disabled version=3.2.5
X-Spam-Report:  * -1.4 ALL_TRUSTED Passed through trusted hosts only via
 SMTP *  8.0 MISSING_SUBJECT Missing Subject: header
X-Spam-Level: ******
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on spr1
Subject: [SPAM:6.6] 

However, when I dropped the score on MISSING_SUBJECT I noted that the
subject was present, but appeared further up (just under the first
received header) but still hitting on the rule:

Received: from [x.x.x.x] by mail.idnetfreemail.co.uk (GMS
 15.02.3689/NU3963.00.7ca42f0c) with ESMTP id tpwpwhca for
 address@hidden; Wed, 7 Apr 2010 20:17:48 +0100
Subject: test it
From: "address@hidden" <address@hidden>
Reply-To: address@hidden
To: address@hidden
Content-Type: text/plain
Organization: address@hidden
Date: Wed, 07 Apr 2010 20:17:49 +0100
Message-Id: <address@hidden>
Mime-Version: 1.0
X-Mailer: Evolution 2.26.1 
Content-Transfer-Encoding: 7bit
X-Spam-Flag: NO
X-Spam-Status: No, score=-0.4 required=5.0
 tests=ALL_TRUSTED,MISSING_SUBJECT autolearn=disabled version=3.2.5
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on spr1

If I take the milter out of the change and use an after-queue content
filter, or pipe the message directly to spamc, or spamassassin I can't
recreate this issue.

I've played around with the -m option on startup, but it makes no
difference. The milter is started like this:

start-stop-daemon --start -b --exec $DAEMON --oknodo --user
spamass-milter -- -r 10 -p $SOCKET

and has an additional conf file like which I don't think it calls
anymore:

# spamass-milt startup defaults

# Default, use the spamass-milter user as the default user, ignore
# messages from localhost
OPTIONS="-u spamass-milter -i 127.0.0.1"

# Reject emails with spamassassin scores > 15.
OPTIONS="-r 15"

# Do not modify Subject:, Content-Type: or body.
#OPTIONS="-m"

Is there a way I can fix the issue with MISSING_SUBJECT?
Can I also have the original subjected appended after the spam score on
positive hits? I can't seem to get it to play nice and I'm sure it's
something I'm doing wrong.